From: Dan Carpenter <dan.carpenter@oracle.com>
To: Alan Stern <stern@rowland.harvard.edu>
Cc: benjamin.tissoires@redhat.com, jikos@kernel.org,
linux-input@vger.kernel.org, linux-usb@vger.kernel.org,
noralf@tronnes.org, syzkaller-bugs@googlegroups.com,
tzimmermann@suse.de
Subject: Re: [PATCH] HID: elo: Fix refcount leak in elo_probe()
Date: Thu, 17 Feb 2022 10:54:36 +0300 [thread overview]
Message-ID: <20220217075436.GA2407@kadam> (raw)
In-Reply-To: <YgcSbUwiALbmoTvL@rowland.harvard.edu>
On Fri, Feb 11, 2022 at 08:50:37PM -0500, Alan Stern wrote:
> Syzbot identified a refcount leak in the hid-elo driver:
>
> BUG: memory leak
> unreferenced object 0xffff88810d49e800 (size 2048):
> comm "kworker/1:1", pid 25, jiffies 4294954629 (age 16.460s)
> hex dump (first 32 bytes):
> ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
> 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
> backtrace:
> [<ffffffff82c87a62>] kmalloc include/linux/slab.h:581 [inline]
> [<ffffffff82c87a62>] kzalloc include/linux/slab.h:715 [inline]
> [<ffffffff82c87a62>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
> [<ffffffff82c91a47>] hub_port_connect drivers/usb/core/hub.c:5260 [inline]
> [<ffffffff82c91a47>] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
> [<ffffffff82c91a47>] port_event drivers/usb/core/hub.c:5660 [inline]
> [<ffffffff82c91a47>] hub_event+0x1097/0x21a0 drivers/usb/core/hub.c:5742
> [<ffffffff8126c3ef>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2307
> [<ffffffff8126ccd9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2454
> [<ffffffff81276765>] kthread+0x125/0x160 kernel/kthread.c:377
> [<ffffffff810022ff>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
>
> Not shown in the bug report but present in the console log:
>
> [ 182.014764][ T3257] elo 0003:04E7:0030.0006: item fetching failed at offset 0/1
> [ 182.022255][ T3257] elo 0003:04E7:0030.0006: parse failed
> [ 182.027904][ T3257] elo: probe of 0003:04E7:0030.0006 failed with error -22
> [ 182.214767][ T3257] usb 1-1: USB disconnect, device number 7
> [ 188.090199][ T3604] kmemleak: 3 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
> BUG: memory leak
>
> which points to hid-elo as the buggy driver.
>
> The leak is caused by elo_probe() failing to release the reference it
> holds to the struct usb_device in its failure pathway. In the end the
> driver doesn't need to take this reference at all, because the
> elo_priv structure is always deallocated synchronously when the driver
> unbinds from the interface.
>
> Therefore this patch fixes the reference leak by not taking the
> reference in the first place.
>
> Reported-and-tested-by: syzbot+8caaaec4e7a55d75e243@syzkaller.appspotmail.com
> Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
> CC: <stable@vger.kernel.org>
>
Alan, this bug was fixed a different way in 817b8b9c5396 ("HID: elo: fix
memory leak in elo_probe") so now the two fixes lead to a use after
free. Your patch is more elegant so we should revert 817b8b9c5396.
regards,
dan carpenter
prev parent reply other threads:[~2022-02-17 7:55 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-11 20:17 [syzbot] memory leak in hub_event (3) syzbot
2022-02-11 21:23 ` Alan Stern
2022-02-11 21:36 ` syzbot
2022-02-12 1:50 ` [PATCH] HID: elo: Fix refcount leak in elo_probe() Alan Stern
2022-02-14 7:34 ` Dongliang Mu
2022-02-14 14:41 ` Alan Stern
2022-02-17 8:04 ` Dan Carpenter
2022-02-17 8:19 ` Dan Carpenter
2022-02-17 13:21 ` Jiri Kosina
2022-02-17 15:25 ` Alan Stern
2022-02-25 9:15 ` Greg KH
2022-02-25 14:38 ` [PATCH] USB: core: Update kerneldoc for usb_get_dev() and usb_get_intf() Alan Stern
2022-03-12 9:39 ` [PATCH] HID: elo: Fix refcount leak in elo_probe() Dongliang Mu
2022-03-12 14:59 ` Alan Stern
2022-02-17 7:54 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220217075436.GA2407@kadam \
--to=dan.carpenter@oracle.com \
--cc=benjamin.tissoires@redhat.com \
--cc=jikos@kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=noralf@tronnes.org \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.